 #!/usr/bin/python
 # -*- coding: utf-8 -*-


# Echo server program
import socket
import os

HOST = ''                 # Symbolic name meaning the local host
PORT = 8760              # Arbitrary non-privileged port

HOST = ''
PORTNO = 8970 # port between firewallagent and bbw2

#orderno, sourceipfrom, sourceipto, destinationipfrom, destinationipto, sourceportfrom, sourceportto, destinationportfrom, destinationportto=None,None,None,None,None,None,None,None,None

data = None
orderno = None

while 1:
		
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
	s.bind((HOST, PORT))
	s.listen(1)
	conn, addr = s.accept()
	print 'Connected by', addr
	while 1:
		data = conn.recv(1024)
		if not data: break
		conn.send(data) # i got the message here now should send it to the bbw2
		
		if not orderno:
		
			try:
				ss = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
				ss.connect((HOST, PORTNO))
				
				ss.send(data)
				datartr=None
				
				while not datartr: 
					datartr=ss.recv(1024) # wait till bbw2 sends something
				
				orderno=datartr # got the orderno
				ss.close()
				
			except:
				continue
			
			
		li=data.split(',')
		print "source", li[0].strip(), "source port", li[1].strip(), "destination", li[2].strip(), "destination port", li[3].strip(), "action", li[4].strip(), "adding"
	    
		#check whether there is a range description in source ip
		sourceipfrom=""
		sourceipto=""
		if li[0].find(":") != -1:
			sourceip=li[0].strip().strip(":")
			sourceipfrom=sourceip[0]
			sourceipto=sourceip[1]
	
		else:
		    	sourceipfrom=li[0].strip()
		    
	
	   	# check whether there is a range description in destination ip
	     	destinationipfrom=""
	     	destinationipto=""
	     	if li[2].find(":") != -1:
		    	destinationip=li[2].strip().strip(":")
		    	destinationipfrom=destinationip[0]
		    	destinationipto=destinationip[1]
	     	else:
		     	destinationipfrom=li[2].strip()
		     

		# check whether the source port is defined as range
		sourceportfrom=""
		sourceportto=""
		if li[1].find(":") != -1:
			sourceport=li[1].strip().strip(":")
			sourceportfrom=sourceport[0]
			sourceportto=sourceport[1]
		if li[1] == "*":
			sourceportfrom="0"
			sourceportto="65535"
		else: sourceportfrom = li[1]
			
		# check whether the source port is defined as range
		destinationportfrom=""
		destinationportto=""
		if li[3].find(":") != -1:
			destinationport=li[3].strip().strip(":")
			destinationportfrom=destinationport[0]
			destinationportto=destinationport[1]
		if li[3] == "*":
			destinationportfrom="0"
			destinationportto="65535"
		else: destinationportfrom = li[3]
				
		srcipto=""
		if sourceipto != "": srcipto = "/"+sourceipto # sourceipfrom+srcipto
		dstipto=""
		if destinationipto != "": dstipto = "/"+destinationipto # destinationipfrom+dstipto
		    
		if sourceportto=="": srcport=sourceportfrom
		else: srcport = sourceportfrom + ":" + sourceportto # use srcport variable in iptables
		    
		if destinationportto=="": dstport=destinationportfrom
		else: dstport = destinationportfrom + ":" + destinationportto # use srcport variable in iptables	
		
		#print li[4].strip().lower() == "accept"
		
		#print type(orderno)
		
		if li[4].strip().lower() == "accept":
			#print orderno 
		    	os.popen("/sbin/iptables -I INPUT %s -p tcp --sport %s --dport %s -s %s -d %s -j ACCEPT" % (orderno.strip(), srcport, dstport, sourceipfrom+srcipto, destinationipfrom+dstipto))
		     
	    	if li[4].strip().lower() == "reject":
		    	os.popen("/sbin/iptables -I INPUT %s -p tcp --sport %s --dport %s -s %s -d %s -j REJECT --reject-with tcp-reset" % (orderno.strip(), srcport, dstport, sourceipfrom+srcipto, destinationipfrom+dstipto))
			
	    	if li[4].strip().lower() == "drop":
		    	os.popen("/sbin/iptables -I INPUT %s -p tcp --sport %s --dport %s -s %s -d %s -j REJECT --reject-with tcp-reset" % (orderno.strip(), srcport, dstport, sourceipfrom+srcipto, destinationipfrom+dstipto))
		
		print "done"
	    	print "..."
		data, orderno = None, None
		break
	
	conn.close()